PT-2018-10013 · Johnson Controls · Bcpro+1

Dan Regalado · Published 2018-08-01 · Updated 2024-09-17 · CVE-2018-10624

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys System versions 8.0 and prior BCPro (BCM) versions prior to 3.0.2

Description This issue results from improper error handling in HTTP-based communications with the server, which could allow an attacker to obtain technical information.

Recommendations For Johnson Controls Metasys System versions 8.0 and prior, update to a version later than 8.0 to resolve the issue. For BCPro (BCM) versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-388

CWE-209

Related Identifiers

CVE-2018-10624

Affected Products

Bcpro

Johnson Controls Metasys System

References · 6

• https://osv.dev/vulnerability/CVE-2018-10624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10624 · Security Note
• https://t.me/cvenotify/68270 · Telegram Post
• https://ics-cert.us-cert.gov/advisories/ICSA-18-212-02 · Note
• https://t.me/cvenotify/94833 · Telegram Post
• http://securityfocus.com/bid/104937 · Note